Data Protection & Compliance
DATA PROTECTION, PRIVACY & MARKETING COMPLIANCE STATEMENT
Company: DEMAND CORE B2B PRIVATE LIMITED
Website: https://www.demandcoreb2b.com
Document Title: Data Protection, Privacy & Marketing Compliance Framework
Applicable Markets: United Kingdom, European Union, North America and Asia-Pacific
Registered Location: Pune, Maharashtra, India
Compliance Contact: info@demandcoreb2b.com
1. INTRODUCTION AND COMMITMENT TO DATA PROTECTION
DEMAND CORE B2B PRIVATE LIMITED (“Demand Core B2B”, “we”, “our” or “the Company”) recognizes the importance of protecting personal information and maintaining responsible data management practices across its international B2B demand generation, lead generation, content syndication, audience research and digital marketing operations.
As a B2B marketing and demand generation service provider, we understand that business contact information, campaign registration details and other professional information must be collected, processed, stored and shared responsibly.
Our approach to data protection is based on transparency, accountability, appropriate data handling practices and compliance with applicable privacy and marketing regulations.
We aim to ensure that personal information is handled in a manner that respects individual privacy rights while supporting legitimate business and marketing activities.
This statement outlines our data protection framework, including our approach to:
International data protection and privacy regulations.
Business contact data sourcing and verification.
Lawful data collection and processing.
Consent management and marketing permissions.
Unsubscribe and opt-out management.
Do-not-contact and suppression procedures.
Data security and access management.
Personal information retention and deletion.
Individual privacy rights and requests.
International data transfers.
Client, vendor and partner responsibilities.
Compliance monitoring and continuous improvement.
This framework applies to relevant business operations, personnel, service providers and campaign-related activities, subject to the Company’s contractual arrangements and applicable legal obligations.
2. GDPR AND UK GDPR COMPLIANCE APPROACH
Demand Core B2B recognizes the importance of complying with applicable data protection requirements when processing information relating to individuals in the United Kingdom, European Economic Area and other jurisdictions with relevant privacy legislation.
Our data protection approach takes into consideration the following regulatory frameworks, where applicable:
General Data Protection Regulation (EU GDPR).
United Kingdom General Data Protection Regulation (UK GDPR).
UK Data Protection Act 2018.
Privacy and Electronic Communications Regulations 2003 (PECR).
California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), where applicable.
Other applicable national and regional privacy and data protection legislation.
We recognize that the applicability of individual regulations depends on factors such as the nature of the processing activity, the location of the individuals concerned, the establishment of the parties involved and the specific business relationship.
2.1 Data Protection Principles
Our data handling framework is guided by the fundamental principles of applicable data protection legislation.
Lawfulness, Fairness and Transparency
Personal information should be processed only where an appropriate legal basis exists. We aim to ensure that individuals receive clear and relevant information regarding how their information is collected, used, shared and retained.
Purpose Limitation
Personal information is collected and processed for specific, legitimate and clearly defined business purposes, including approved B2B marketing campaigns, audience research, lead generation, content syndication and campaign delivery.
Information should not be used for purposes that are incompatible with the original purpose of collection or applicable legal requirements.
Data Minimization
We aim to collect and process only the personal information reasonably necessary for the relevant business activity or campaign requirements.
Unnecessary information should not be requested, collected or retained without an appropriate justification.
Accuracy
We recognize the importance of maintaining accurate and relevant business contact information.
Appropriate verification and quality assurance procedures may be used to identify outdated, incomplete, duplicate or inaccurate records and address identified inaccuracies.
Storage Limitation
Personal information should not be retained indefinitely.
Retention periods are determined according to the purpose of processing, contractual requirements, applicable legal obligations and legitimate business recordkeeping needs.
Integrity and Confidentiality
Appropriate technical and organizational security measures should be implemented to protect personal information against unauthorized access, accidental disclosure, alteration, destruction or loss.
Accountability
We aim to maintain appropriate records and supporting documentation relating to data sourcing, processing activities, campaign instructions, lawful basis assessments, data-sharing arrangements and relevant compliance procedures.
2.2 Lawful Basis for Processing
Demand Core B2B recognizes that personal information must be processed under an appropriate lawful basis.
Depending on the nature of a specific activity, applicable lawful bases may include:
Consent provided by the individual.
Legitimate interests, where the interests and fundamental rights and freedoms of the individual do not override those interests.
Contractual necessity, where processing is objectively necessary to perform a contract with the individual or take steps requested by them before entering into a contract.
Legal obligations, where processing is necessary to comply with applicable law.
The appropriate lawful basis must be assessed for the particular processing activity rather than assumed to apply universally to all B2B marketing activities.
Where legitimate interests are relied upon, an appropriate assessment should be conducted and documented where required.
Where consent is required, it should be obtained and recorded in accordance with applicable legal standards.
2.3 Controller and Processor Responsibilities
Depending on the nature of an engagement, Demand Core B2B may act as:
A data controller, where it independently determines the purposes and means of processing.
A data processor, where it processes personal information on behalf of a client under documented instructions.
A joint controller, where it jointly determines the purposes and means of processing with another organization, where the applicable legal criteria are met.
These responsibilities are determined by the actual processing activities and the parties’ respective decision-making roles, rather than contractual labels alone.
Where applicable, we aim to establish appropriate contractual arrangements, including:
Data Processing Agreements (DPAs).
Data Sharing Agreements.
Confidentiality Agreements.
Security and data handling commitments.
Other relevant contractual safeguards.
3. DATA SOURCING AND VERIFICATION PRACTICES
Demand Core B2B provides B2B demand generation, prospect identification, audience research, content syndication and qualified lead generation services.
We recognize that responsible data sourcing is fundamental to maintaining the quality, accuracy and legal suitability of business contact information.
Our approach is designed to ensure that information used for campaign activities is obtained from appropriate sources and assessed according to the requirements of the relevant campaign and jurisdiction.
3.1 Data Collection Sources
Depending on the campaign requirements and applicable legal restrictions, business contact information may be obtained through:
Publicly available corporate websites and company information.
Professional business directories and industry databases.
Reputable third-party data providers.
Client-provided databases and approved target account lists.
Website registration forms and gated content downloads.
Webinar, event and other business registration activities.
Business networking and professional information sources.
Other legitimate business information sources appropriate to the campaign.
The use of publicly available information does not automatically establish permission to use that information for marketing purposes.
We recognize that the collection, subsequent processing and use of personal information must be assessed independently against applicable privacy and marketing requirements.
3.2 Third-Party Data Provider Due Diligence
Where third-party providers are used, appropriate consideration should be given to their data sourcing practices, contractual commitments, privacy disclosures and ability to support relevant compliance requirements.
Depending on the engagement, due diligence may include reviewing:
The provider’s data collection methods.
The origin and reliability of supplied information.
Available lawful basis information.
Consent and permission records, where relevant.
Privacy notices and data use disclosures.
Data accuracy and verification procedures.
Available suppression and opt-out mechanisms.
Relevant contractual and security commitments.
Applicable international transfer arrangements.
Third-party data should be used only where its acquisition and subsequent processing are considered appropriate for the intended purpose and jurisdiction.
3.3 Data Verification and Quality Assurance
We recognize that accurate information supports better campaign performance and reduces unnecessary or irrelevant communications.
Our campaign-specific quality assurance process may include:
Business Email Validation: Reviewing business email addresses for format, validity and deliverability indicators using appropriate validation methods.
Company Verification: Checking company names, websites and relevant organizational information.
Job Title Verification: Assessing professional titles, job functions and seniority against campaign targeting requirements.
Industry Classification: Reviewing business sectors and industry categories for campaign relevance.
Geographic Validation: Checking whether contact records align with the approved target countries, regions and territories.
Target Account Matching: Comparing records against approved target account and Ideal Customer Profile (ICP) requirements.
Duplicate Identification: Identifying duplicate records to minimize repeated submissions and unnecessary campaign activity.
Suppression Screening: Reviewing applicable internal, client-provided and campaign-specific exclusion lists.
Qualification Review: Checking submitted information against the qualification criteria agreed with the client.
3.4 Campaign-Specific Data Requirements
Each campaign may have different audience requirements depending on:
Target industry.
Company size and revenue range.
Geographic location.
Job title and seniority.
Department and professional function.
Target account specifications.
Content engagement requirements.
Registration and qualification criteria.
We aim to align audience selection and lead qualification with the campaign brief and the client’s documented requirements.
4. CONSENT MANAGEMENT AND MARKETING PERMISSIONS
Demand Core B2B recognizes the importance of obtaining and managing appropriate permissions for marketing activities.
The legal requirements governing marketing communications vary depending on the communication channel, recipient type, location and applicable legislation.
We therefore recognize that consent is not the only possible lawful basis for processing personal information, and that a lawful basis for data processing does not automatically authorize every form of electronic marketing.
4.1 Consent Collection Principles
Where consent is the appropriate legal basis, it should be:
Freely given.
Specific to the relevant purpose.
Informed and transparent.
Unambiguous.
Provided through a clear affirmative action.
Capable of being withdrawn.
Recorded with appropriate supporting evidence.
Consent language should clearly explain the purpose of collection and relevant communication activities.
Where third-party sharing or marketing communications are contemplated, the relevant disclosures and permissions should be sufficiently clear and specific to meet applicable legal requirements.
4.2 Registration and Consent Mechanisms
Where campaign registration involves consent-based collection, the registration process may include:
Clear and understandable consent statements.
Appropriate privacy notice links.
Separate consent choices where required.
Unchecked consent boxes where checkbox consent is used.
Clear identification of relevant organizations or recipient categories.
Appropriate affirmative registration actions.
Double opt-in confirmation where required or implemented as a campaign control.
The registration mechanism should not rely on preselected consent boxes, silence or inactivity as evidence of consent.
4.3 Consent Evidence and Documentation
Where applicable, relevant consent and registration records may include:
Individual’s submitted email address.
Registration date and time.
Registration source or collection channel.
Campaign identification or reference.
Consent wording displayed at the time of registration.
Applicable privacy notice version.
Relevant third-party disclosures.
Consent confirmation status.
Double opt-in confirmation, where applicable.
Available withdrawal or modification records.
Such records may be maintained to support accountability and demonstrate the basis on which the relevant activity was conducted.
4.4 Legitimate Interests and B2B Marketing
We recognize that legitimate interests may provide a lawful basis for certain B2B data processing activities where the applicable legal requirements are satisfied.
However, legitimate interests must not be treated as a blanket authorization for all marketing communications.
Where this basis is considered, relevant factors may include:
The nature of the business relationship.
The individual’s reasonable expectations.
The relevance of the marketing activity.
The type and source of information.
The potential impact on the individual.
The availability of less intrusive alternatives.
The individual’s right to object.
Where required, an appropriate Legitimate Interests Assessment (LIA) should be completed and documented.
4.5 Withdrawal of Consent and Unsubscribe Management
Individuals should have appropriate and accessible mechanisms to withdraw consent or unsubscribe from relevant marketing communications.
We aim to ensure that valid unsubscribe and withdrawal requests are handled promptly and incorporated into applicable suppression procedures.
Our approach includes:
Recording relevant unsubscribe requests.
Updating applicable suppression records.
Communicating valid requests to relevant clients or partners where necessary.
Respecting campaign-specific exclusion instructions.
Preventing unnecessary reintroduction of suppressed contacts.
Maintaining appropriate records of opt-out activity.
An objection to direct marketing should be respected in accordance with applicable legal requirements.
5. DO-NOT-CONTACT AND SUPPRESSION MANAGEMENT
Demand Core B2B recognizes the importance of respecting communication preferences and preventing unwanted marketing communications.
We aim to apply appropriate suppression and exclusion procedures before and during relevant campaign activities.
5.1 Internal Suppression Lists
Where maintained, internal suppression records may include individuals who have:
Unsubscribed from relevant communications.
Withdrawn consent.
Objected to direct marketing.
Requested no further contact.
Otherwise indicated a relevant communication preference.
These records should be used to prevent inappropriate future inclusion in applicable campaigns.
Suppression records may retain limited information, such as an email address or another identifier, where necessary to ensure that an individual’s opt-out preference continues to be respected.
5.2 Client-Supplied Suppression Lists
Clients may provide exclusion files containing contacts, companies, domains or other identifiers that must not be included in a particular campaign.
Where supplied, such lists should be reviewed and applied according to the agreed campaign requirements.
5.3 Campaign-Level Exclusions
Campaign exclusions may include:
Restricted geographic locations.
Specific companies or corporate groups.
Competitors.
Existing customers.
Previously submitted contacts.
Contacts who have already received the relevant content.
Specific job titles or departments.
Industry exclusions.
Other client-defined restrictions.
5.4 Duplicate and Repeat Submission Prevention
We recognize the importance of minimizing duplicate submissions and unnecessary repeated communications.
Campaign-specific checks may be used to identify previously submitted contacts and prevent duplication according to the agreed delivery rules.
5.5 Regulatory Do-Not-Contact Screening
Where applicable to the communication channel, recipient type and jurisdiction, relevant regulatory suppression requirements and do-not-contact registers should be considered.
For UK campaigns, we recognize that PECR distinguishes between corporate subscribers and individual subscribers.
Marketing rules may differ for limited companies, sole traders and certain partnerships.
For telephone marketing, relevant screening requirements may include applicable Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) checks.
For email marketing, the applicable rules must be assessed separately, including relevant PECR requirements and UK GDPR obligations.
For campaigns targeting other jurisdictions, relevant national or regional marketing restrictions must also be considered.
5.6 Suppression List Maintenance
We aim to ensure that suppression records are updated when valid unsubscribe, objection or do-not-contact requests are received.
Access to suppression records should be appropriately restricted, and such information should be retained only as necessary to respect the individual’s preferences and satisfy applicable obligations.
6. DATA SECURITY AND INFORMATION PROTECTION
Demand Core B2B recognizes that personal information and business contact records must be protected throughout their collection, processing, storage, transfer and deletion lifecycle.
We support a risk-based approach to information security, with safeguards proportionate to the nature, sensitivity and volume of information processed.
6.1 Access Control and Authorization
Access to personal information should be restricted to authorized personnel who require such information to perform their assigned responsibilities.
Appropriate controls may include:
Role-based access permissions.
Individual user accounts.
Password-protected systems.
Access restrictions for campaign databases.
Periodic review of access permissions.
Removal of access when no longer required.
Restricted handling of sensitive campaign files.
6.2 Secure Data Transmission
Campaign information and client deliverables should be transferred using appropriate methods designed to protect against unauthorized access or disclosure.
Depending on the engagement, security measures may include:
Secure file-sharing platforms.
Encrypted transfer methods.
Access-controlled download links.
Restricted recipient permissions.
Appropriate password protection.
Secure communication channels.
6.3 System and Device Security
We recognize the importance of maintaining appropriate security across devices, applications and systems used to handle business information.
Relevant safeguards may include:
Updated operating systems and software.
Appropriate endpoint protection.
Secure account authentication.
Malware protection.
Network security controls.
Device access restrictions.
Appropriate backup procedures.
Secure disposal of devices and storage media.
6.4 Employee and Personnel Confidentiality
Personnel who handle client or campaign information should understand their responsibilities concerning privacy, confidentiality and information security.
Appropriate safeguards may include:
Confidentiality obligations.
Access limited to assigned responsibilities.
Data handling instructions.
Relevant privacy and security awareness.
Reporting procedures for suspected incidents.
6.5 Security Incident Management
We aim to maintain procedures for identifying, investigating, documenting and responding to suspected security incidents involving personal information.
Depending on the nature of an incident, relevant activities may include:
Identifying and assessing the suspected incident.
Containing the incident and limiting further exposure.
Investigating the affected systems and information.
Assessing potential risks to affected individuals.
Documenting relevant findings and corrective actions.
Notifying the appropriate client, controller or responsible party.
Supporting legally required regulatory or individual notifications.
Reviewing the incident and implementing appropriate improvements.
Where statutory breach notification obligations apply, notifications should be made within the relevant legal timeframes.
For example, under GDPR, a controller may be required to notify the relevant supervisory authority within 72 hours of becoming aware of a reportable personal data breach, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.
Where Demand Core B2B acts as a processor, it should notify the relevant controller without undue delay in accordance with applicable legal and contractual requirements.
7. DATA RETENTION, DELETION AND DISPOSAL
Demand Core B2B recognizes that personal information should be retained only for as long as necessary for the purposes for which it is processed, subject to applicable legal and contractual obligations.
7.1 Retention Principles
Retention periods may depend on:
The original purpose of data collection.
Campaign execution and reporting requirements.
Client contractual obligations.
Legal and regulatory requirements.
Data accuracy and verification needs.
Legitimate business recordkeeping requirements.
Individual rights and valid requests.
Relevant dispute resolution or legal claims.
We do not intend to retain personal information indefinitely without an appropriate purpose.
7.2 Data Deletion
Where personal information is no longer required, it should be securely deleted, anonymized or otherwise disposed of, subject to applicable legal retention obligations.
Deletion procedures should take into consideration:
Active campaign databases.
Downloaded campaign files.
Shared client deliverables.
Relevant internal records.
Backups and archived information.
Third-party service provider records, where applicable.
7.3 Client Data Retention
Where information is processed on behalf of a client, retention and deletion arrangements should be governed by the applicable contractual instructions and data processing agreement.
Upon completion or termination of an engagement, personal information should be returned or deleted in accordance with the agreed contractual requirements, unless retention is required by applicable law.
7.4 Suppression Records
Limited suppression information may need to be retained to ensure that individuals who have opted out are not inadvertently contacted again.
Such information should be retained only to the extent necessary for the relevant suppression purpose and handled in accordance with applicable privacy requirements.
8. PRIVACY AND DATA HANDLING PROCEDURES
Demand Core B2B aims to apply responsible information handling practices throughout the complete campaign lifecycle.
Our approach considers the following stages.
8.1 Data Collection
Information may be collected from approved business sources, registration activities, client-provided databases or relevant third-party sources.
Collection activities should be aligned with the applicable purpose, legal basis, campaign requirements and privacy disclosures.
8.2 Data Assessment and Validation
Information may be assessed for:
Source suitability.
Accuracy and completeness.
Business relevance.
Geographic suitability.
Target audience alignment.
Duplicate records.
Applicable suppression requirements.
Information that does not satisfy the agreed campaign requirements may be excluded.
8.3 Data Processing
Personal information should be processed only for defined and appropriate business purposes.
Where Demand Core B2B acts as a processor, processing should follow documented client instructions and applicable contractual obligations.
Where Demand Core B2B acts as a controller, it should independently identify and document the relevant purposes, lawful basis and applicable privacy obligations.
8.4 Data Sharing and Disclosure
Campaign information may be shared with clients, authorized partners or other relevant recipients where the sharing is necessary for the agreed business purpose and permitted by applicable law.
Where lead information is delivered to One Reach B2B, its named end customer or another authorized campaign partner, the relevant data-sharing activity should be supported by appropriate legal grounds, privacy disclosures and contractual arrangements.
We do not consider general marketing consent to constitute unrestricted authorization for sharing personal information with unrelated organizations.
Where appropriate, the relevant arrangements should identify:
The organizations receiving the information.
The purposes for which the information may be used.
The permitted processing activities.
Applicable confidentiality requirements.
Relevant retention and deletion arrangements.
Responsibilities for handling individual rights requests.
Applicable international transfer safeguards.
8.5 Individual Privacy Rights
Demand Core B2B recognizes that individuals may have rights under applicable data protection legislation.
Depending on the jurisdiction and circumstances, these may include:
Right of Access: The right to request access to personal information held about them.
Right to Rectification: The right to request correction of inaccurate or incomplete personal information.
Right to Erasure: The right to request deletion of personal information where the applicable legal conditions are satisfied.
Right to Restriction: The right to request restriction of certain processing activities.
Right to Data Portability: The right to receive certain personal information in a structured, commonly used and machine-readable format, where the applicable requirements are met.
Right to Object: The right to object to certain processing activities, including direct marketing.
Right to Withdraw Consent: The right to withdraw previously provided consent where consent is the lawful basis for processing.
Rights Relating to Automated Decision-Making: Rights concerning certain solely automated decisions and profiling, where applicable.
The availability and scope of these rights depend on the applicable legislation and the specific processing activity.
8.6 Handling Individual Rights Requests
We aim to support appropriate procedures for receiving, assessing and responding to relevant privacy requests.
Requests may be received through designated communication channels, including:
Email: info@demandcoreb2b.com
Where necessary, appropriate identity verification may be undertaken to protect individuals against unauthorized disclosure.
Where Demand Core B2B acts as a processor, requests should be coordinated with the relevant controller in accordance with contractual arrangements.
Requests should be handled within applicable statutory timeframes.
Under GDPR, the general response period for qualifying individual rights requests is one month, subject to permitted extensions in certain circumstances.
8.7 International Data Transfers
Demand Core B2B operates from India and may work with clients, partners and service providers located in different jurisdictions.
Where personal information is transferred internationally, the applicable transfer requirements should be assessed before the transfer takes place.
Depending on the jurisdictions involved, appropriate safeguards may include:
Standard Contractual Clauses (SCCs).
UK International Data Transfer Agreements (IDTAs).
UK Addendum to the EU Standard Contractual Clauses.
Relevant adequacy decisions or regulations.
Appropriate transfer risk assessments.
Additional technical and organizational safeguards, where required.
International data transfers should be conducted in accordance with applicable legal requirements and the contractual responsibilities of the parties involved.
9. CLIENT, VENDOR AND THIRD-PARTY RESPONSIBILITIES
Demand Core B2B recognizes that effective data protection requires cooperation between clients, partners, service providers and other organizations involved in the processing lifecycle.
9.1 Client Responsibilities
Clients engaging Demand Core B2B should provide clear instructions regarding campaign objectives, permitted data uses and relevant compliance requirements.
Depending on the engagement, client responsibilities may include:
Defining the intended campaign purpose.
Establishing an appropriate lawful basis.
Providing accurate campaign instructions.
Supplying applicable exclusion and suppression lists.
Providing relevant privacy disclosures.
Confirming appropriate marketing permissions where required.
Defining permitted recipients and data-sharing arrangements.
Communicating relevant individual rights requests.
Establishing appropriate retention requirements.
9.2 Vendor and Partner Responsibilities
Where third-party service providers or campaign partners are involved, relevant responsibilities should be documented and assessed.
Appropriate arrangements may address:
Confidentiality obligations.
Data protection responsibilities.
Information security expectations.
Permitted processing purposes.
Subprocessor requirements.
Data retention and deletion.
Incident reporting.
International transfer requirements.
9.3 Contractual Safeguards
Depending on the relationship and applicable law, relevant contractual documents may include:
Data Processing Agreements.
Data Sharing Agreements.
Non-Disclosure Agreements.
Confidentiality Agreements.
Information Security Requirements.
Campaign-Specific Data Handling Instructions.
These arrangements should reflect the actual responsibilities and activities of the parties involved.
10. COOKIES, WEBSITE TRACKING AND DIGITAL PRIVACY
Demand Core B2B recognizes that website technologies such as cookies, tracking pixels and similar technologies may collect information about website visitors and their interactions.
Where such technologies are used, their deployment should comply with applicable privacy and electronic communications requirements.
Depending on the technologies implemented, website privacy practices may include:
Disclosure of relevant cookie categories.
Explanation of cookie purposes.
Appropriate consent mechanisms where required.
Options to manage cookie preferences.
Information regarding third-party tracking technologies.
Details concerning data collection and usage.
Appropriate retention and access controls.
Non-essential cookies and similar technologies should not be deployed before obtaining consent where applicable law requires prior consent.
Visitors should be able to access relevant cookie information and manage their preferences through the website’s cookie controls.
Additional information should be provided in the Company’s Cookie Policy and Privacy Policy.
11. COMPLIANCE MONITORING AND CONTINUOUS IMPROVEMENT
Demand Core B2B recognizes that data protection and marketing compliance are ongoing responsibilities rather than one-time activities.
Our compliance framework is intended to evolve in response to regulatory developments, operational changes, client requirements and emerging information security risks.
11.1 Periodic Compliance Reviews
Relevant compliance procedures should be reviewed periodically, including:
Data sourcing and verification practices.
Campaign registration and consent mechanisms.
Suppression and unsubscribe procedures.
Data retention and deletion arrangements.
Access management and security controls.
Third-party provider arrangements.
Client data processing agreements.
International transfer arrangements.
Privacy notices and website disclosures.
11.2 Regulatory Developments
We recognize that international privacy and marketing regulations may change over time.
Where relevant, we aim to assess developments affecting our business operations and make appropriate updates to internal procedures and contractual arrangements.
11.3 Employee Awareness
Personnel handling personal information should be made aware of relevant data protection responsibilities and appropriate information handling procedures.
Training and awareness activities may cover:
Privacy principles.
Confidentiality responsibilities.
Appropriate data access.
Secure data handling.
Marketing permissions.
Suppression procedures.
Incident reporting.
Individual rights requests.
11.4 Corrective Actions
Where gaps or weaknesses are identified in relevant data handling procedures, appropriate corrective actions should be considered and implemented according to the nature and significance of the issue.
Our objective is to support responsible, transparent and sustainable data processing practices.
12. COMPLIANCE CONTACT AND PRIVACY ENQUIRIES
Demand Core B2B welcomes enquiries relating to privacy, personal information, campaign data handling and relevant compliance documentation.
Individuals, clients, partners and other stakeholders may contact us using the details below.
Company: DEMAND CORE B2B PRIVATE LIMITED
Website: https://www.demandcoreb2b.com
Email: info@demandcoreb2b.com
Location: Pune, Maharashtra, India.
For privacy-related requests, individuals are encouraged to provide sufficient information to help us identify the relevant processing activity and respond appropriately.
Where a request relates to information processed on behalf of a client, we may need to coordinate with the relevant client or data controller before taking action.
13. DOCUMENT STATUS, SCOPE AND REVIEW
This Data Protection, Privacy & Marketing Compliance Statement describes the Company’s intended data protection framework and its approach to responsible information handling across relevant B2B marketing and demand generation activities.
It should be read together with the Company’s Privacy Policy, Cookie Policy, applicable contractual agreements and relevant campaign-specific privacy disclosures.
This document is a corporate compliance statement. It does not, by itself, constitute:
A formal certification under GDPR or any other privacy framework.
Registration with the UK Information Commissioner’s Office (ICO).
An independent information security audit.
A guarantee of compliance for every campaign or processing activity.
A substitute for applicable Data Processing Agreements or legal assessments.
The actual implementation of individual controls depends on operational practices, contractual arrangements, technical capabilities and applicable legal requirements.
Document Review Policy
This statement should be reviewed at least annually and whenever material changes occur to:
Business operations.
Data collection and sourcing practices.
Processing activities.
Marketing communication methods.
Applicable regulatory requirements.
Client and partner arrangements.
Information security procedures.